Support » Plugin: Wordfence Security - Firewall & Malware Scan » ?wordfence_lh URLs in live traffic

  • Resolved swissspaceboy

    (@swissspaceboy)


    Hello,
    I have seen similar posts for this topic, but I do not really understand.

    In my live traffic of 8 October, I can see some ?wordfence_lh URLs. When I click on the link, I get a blank page.

    What is this URL and why is it coming up in my live traffic? Are these URLs exposed to the public and bots like Google? I haven’t checked if Google has indexes these pages.

    I would like to understand what is this URL and why it gets triggered in my activity log?

    I have no cache plugins except Autoptimize to cache my css and js files.

    Time:	1 hour 45 mins ago -- Thu, 08 Oct 20 08:59:41 +0000 -- 1602147581.802051 in Unixtime
    Secs since last hit:	6.9201
    URL:	https://www.xx.yy/services/ 
    
    Type:	Normal request
    Referrer:	https://www.xx.yy/tarifs/externalisation-support-administratif/ 
    
    Full Browser ID:	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:78.0) Gecko/20100101 Firefox/78.0
    Location:	Lausanne, Switzerland 
    
    Time:	1 hour 45 mins ago -- Thu, 08 Oct 20 08:59:34 +0000 -- 1602147574.881996 in Unixtime
    Secs since last hit:	7.8230
    URL:	https://www.xx.yy/?wordfence_lh=1&hid=817BA04E049F7C89D8B506BCE9DAF5A6&r=0.814095156328365 
    
    Type:	Normal request
    Referrer:	https://www.xx.yy/tarifs/externalisation-support-administratif/ 
    
    Full Browser ID:	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:78.0) Gecko/20100101 Firefox/78.0
    Location:	Lausanne, Switzerland 
    
    Time:	1 hour 46 mins ago -- Thu, 08 Oct 20 08:59:27 +0000 -- 1602147567.058997 in Unixtime
    URL:	https://www.xx.yy/tarifs/externalisation-support-administratif/ 
    
    Type:	Normal request
    Referrer:	https://startpage.com/ 
    
    Full Browser ID:	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:78.0) Gecko/20100101 Firefox/78.0
    Location:	Lausanne, Switzerland 

    Many thanks,

    Didier.

Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Support WFAdam

    (@wfadam)

    Hello @swissspaceboy and thanks for reaching out to us!

    Wordfence ?wordfence_lh=1&hid= query string URL’s are used by Live Traffic. They should load a blank page when visited directly. Some people have badly coded themes or added bad code to their theme and instead of a blank page being generated the home page loads instead. This causes Google to index the ?wordfence_lh=1&hid= query string URL’s as Google sees them as legitimate site pages.

    Since you are loading a blank page, these URLs are completely normal.

    Let me know if this helps!

    Thanks!

    Hi Adam,

    Thanks for the fast reply.

    But you didn’t answer why these URLs are visible from the front end. I do not see this URL as a link in my page for example.

    So where is it stored in the frontend page that people can visit? Is this appended somewhere automatically?

    Thanks for some technical background information so that I can explain my customer the how, what and why 🙂

    Thanks,

    Didier.

    Plugin Support WFAdam

    (@wfadam)

    What do you mean by visible from the front end? Can you show me an example?

    Thanks!

    Hi Adam,

    With front-end I mean, that WordFence is for me a backend/admin feature. When I look at the HTML source code of one page, I do not see this WF URL (nor in CSS or Javascript), so I was wondering how this WF URL can show up in the live traffic, that is showing all visits of my webite frontend (my public website).

    Live traffic is not tracking all backend/admin accesses and visits, so how come that I see this WF URL in my live traffic. That’s the only thing that I would like to understand.

    Thanks,

    Didier.

    Plugin Support WFAdam

    (@wfadam)

    This is more so a problem when you’re seeing those links indexed by search engines, which is not common, and typically only happens when there is something in the theme that is causing those links to redirect to the homepage, rather than show a blank white page with a number in the corner.

    You can also switch your Live Traffic to display only security traffic as well. Which should eliminate these hits for you.

    ok thanks for the explanation.

    Didier.

Viewing 6 replies - 1 through 6 (of 6 total)
  • You must be logged in to reply to this topic.